# PhishDestroy domain threat record: forbet.info.pl Content language: English Canonical HTML report: https://phishdestroy.io/domain/forbet.info.pl/ Machine-readable companion: https://phishdestroy.io/domain/forbet.info.pl/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 23:32:34 UTC - Last availability or vendor check: 2026-10-27 23:36:09 UTC - Stored record updated: 2026-10-27 23:36:09 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: Key-Systems GmbH - Registrar country in stored WHOIS data: PL - Last stored HTTP status: 200 - Registration date (registry RDAP, info.pl): 2003-03-25 11:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17a8d-f023-7365-9555-8b9f1960cf4b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/forbet.info.pl - Certificate Transparency search: https://crt.sh/?q=%25.forbet.info.pl - Web Archive lookup: https://web.archive.org/web/*/https://forbet.info.pl/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified the site as malicious because it mimics the legitimate bookmaker forbet, uses a look‑alike domain and displays login and registration prompts that could harvest credentials. The recorded page title and excerpt advertise a free 200 zł betting bonus and boosted odds, which matches the assessment’s brand‑impersonation concern. PhishDestroy first observed the domain on 2026-10-27 and recorded an HTTP 200 response on that date. How the scam works In brand‑impersonation phishing, attackers register a domain similar to a trusted brand and copy its visual cues to convince users to enter account credentials. Harvested credentials can then be used to access the real service, steal funds, or be sold to other criminals. Evidence VirusTotal scanned the domain on 2026-10-23 and reported 16 detections across 92 engines, with 13 labeled malicious and 3 suspicious. Google Safe Browsing checked the URL on 2026-10-27 and did not flag it. Cloudflare Radar on 2026-10-27 marked the site as phishing and malware. PhishDestroy’s internal blocklist contains the domain as of 2026-10-27, and OTX listed three pulses referencing it on the same day. URLScan captured the page on 2026-08-05 with a clean verdict, while a later capture on 2026-10-27 received a malicious ML score of 89 but an overall non‑malicious overall verdict. No external public blocklists reported the domain. Infrastructure The domain is 163 days old and is served through Cloudflare’s network (CloudFLARENET‑EU) with a recorded IP of 188.114.96.3 located in the United Kingdom. TLS was issued by Google Trust Services on 2026-10-04, valid until 2027-01-02, covering the host name and its subdomains. Nameservers are lewis.ns.cloudflare.com and thea.ns.cloudflare.com, indicating Cloudflare as the CDN and DNS provider. What to do Anyone who may have entered a forbet account password on this site should change that password on the official forbet.pl site and enable two‑factor authentication. Security teams should add forbet.info.pl to their phishing blocklists and monitor access logs for connections to this exact domain. Users should remain cautious of unsolicited offers promising free bets or bonuses from unfamiliar URLs. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17a8d-f023-7365-9555-8b9f1960cf4b/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e9861206-fbfc-4d02-844a-91e74d218321 Stored capture screenshot: https://i.ibb.co/xt5QsV5L/1e4a73962d13.png Cloudflare Radar screenshot (2026-10-27T00:05:22Z): https://screenshots.phishdestroy.io/cf/e9861206-fbfc-4d02-844a-91e74d218321.png URLScan screenshot (2026-08-05T11:27:34Z): https://screenshots.phishdestroy.io/us/019fd1ad-adb2-72b3-ad08-b710bd6d74ec.png URLScan capture report: https://urlscan.io/result/019fd1ad-adb2-72b3-ad08-b710bd6d74ec/ VirusTotal report: https://www.virustotal.com/gui/domain/forbet.info.pl Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=forbet.info.pl Archived copy: https://web.archive.org/web/20261026233124/https://forbet.info.pl/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 00:06:00 UTC ## Stored page captures - Primary capture: https://i.ibb.co/xt5QsV5L/1e4a73962d13.png Captured: 2026-10-26 23:32:34 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17a8d-f023-7365-9555-8b9f1960cf4b.png Captured: 2026-10-26 23:32:34 UTC Source report: https://urlscan.io/result/01a17a8d-f023-7365-9555-8b9f1960cf4b/ - URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd1ad-adb2-72b3-ad08-b710bd6d74ec.png Captured: 2026-08-05 11:27:34 UTC Source report: https://urlscan.io/result/019fd1ad-adb2-72b3-ad08-b710bd6d74ec/ SHA-256: 65dee0bdb9c31c713c7fd91dba46bc0c6d089395dcc168d52c377814d4960fe3 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e9861206-fbfc-4d02-844a-91e74d218321.png Captured: 2026-10-27 00:05:22 UTC Source report: https://radar.cloudflare.com/scan/e9861206-fbfc-4d02-844a-91e74d218321 SHA-256: 2cce56b150babf3a6c280f5847271390f7ae9a32d1612c28329039b51134f98f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T00:05:40Z", "uuid": "01a17a8d-f023-7365-9555-8b9f1960cf4b", "scanned_at": "2026-10-26T23:31:37Z", "final_url": "https://forbet.info.pl/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://forbet.info.pl/", "from": "http://forbet.info.pl/", "status": 307 } ], "ip": "172.64.80.1", "domains": [ "fonts.gstatic.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "142.251.16.94", "104.16.80.73", "172.253.115.95", "172.64.80.1" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "odpowiedzialnagra.totalizator.pl", "www.podatki.gov.pl" ], "doc_hash": "1637534af968b9afcf65155ff1f1e903f33a6a4ff82846d143c0296d550b6c15", "globals": [ "__cfBeacon" ], "tls": { "san": [ "forbet.info.pl", "*.forbet.info.pl" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "forbet.info.pl", "protocol": "TLS 1.3", "valid_to": "2027-01-02T20:22:05Z", "valid_from": "2026-10-04T19:22:10Z" }, "domain_age_days": 163, "apex_age_days": 163, "tls_age_days": 22, "tls_valid_days": 90, "requests": 18, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 89, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T00:05:42Z", "uuid": "e9861206-fbfc-4d02-844a-91e74d218321", "scanned_at": "2026-10-27T00:05:22Z", "final_url": "https://forbet.info.pl/", "status": 200, "history": [ { "url": "https://forbet.info.pl/", "status": 200 } ], "dom_hash": "14a30ad7cfb47bdd86b6411c3b1455e2d29c8fa794a16a2a5d8e1e5778ff0cca", "doc_hash": "1637534af968b9afcf65155ff1f1e903f33a6a4ff82846d143c0296d550b6c15", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "forbet.info.pl", "type": "A", "value": "188.114.96.0" }, { "name": "forbet.info.pl", "type": "A", "value": "188.114.97.0" }, { "name": "forbet.info.pl", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "forbet.info.pl", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Key-Systems GmbH", "created": "2026-05-13T14:29:08Z", "updated": "2026-06-08T17:52:32Z", "expires": "2027-05-13T14:29:08Z", "nameservers": [ "lewis.ns.cloudflare.com", "thea.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T00:05:15Z", "analysis_at": "2026-10-23T14:37:53Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 13, "suspicious": 3, "undetected": 32 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-05-16T09:38:30Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.190.20" }, { "ttl": 300, "type": "A", "value": "104.21.57.107" }, { "ttl": 300, "type": "MX", "value": "route3.mx.cloudflare.net", "priority": 43 }, { "ttl": 300, "type": "MX", "value": "route2.mx.cloudflare.net", "priority": 56 }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:_spf.mx.cloudflare.net ~all" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:be14" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:396b" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "lewis.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "thea.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "lewis.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "route1.mx.cloudflare.net", "priority": 72 } ], "dns_at": "2026-10-23T14:39:10Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "forbet.info.pl", "*.forbet.info.pl" ], "issuer": "Google Trust Services / WE1", "serial": "7a22d441ae1cd487134cf15c2776f64f", "sha256": "365c6ceb08f9140e38b346e23d88d6ae046f3cc110f88107bfcc37e95456aafe", "subject": "forbet.info.pl", "valid_to": "2027-01-02T20:22:05Z", "valid_from": "2026-10-04T19:22:10Z" }, "whois": { "dnssec": "Unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T23:56:18Z", "mail_config": { "mx": [ "route3.mx.cloudflare.net", "route2.mx.cloudflare.net", "route1.mx.cloudflare.net" ], "spf": "v=spf1 include:_spf.mx.cloudflare.net ~all", "dane": true, "spf_lookups": 1 }, "caa_records": { "domain": "forbet.info.pl" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T23:31:24Z", "first": "2026-10-12T06:54:25Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.07, "avg_page_bytes": 10555 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "http://forbet.info.pl/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 15 }, "social_tags": { "ogUrl": "http://forbet.info.pl/", "title": "forbet – Darmowy zakład 200 zł + boost kursów", "ogType": "website", "ogTitle": "forbet – najlepsze kursy i bonusy na start", "keywords": "forbet, zakłady sportowe, darmowy zakład, boost kursów, polska bukmacherka, ubezpieczenie akumulatora, szybkie wypłaty", "description": "Odbierz darmowy zakład 200 zł, boost kursów do 50% i ubezpieczenie akumulatorów. Szybkie wypłaty Blikiem i Przelewy24. Obstawiaj teraz na forbet.", "twitterCard": "summary_large_image", "canonicalUrl": "https://forbet.info.pl/", "ogDescription": "Darmowy zakład 200 zł i boost do 50%. Obstaw sport i e-sport z forbet." }, "trackers": { "requests": 14, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 33, "tls": 19, "wait": 3446, "connect": 16, "download": 1 }, "response_ms": 3515 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 36444, "co2_grams": 0.0013, "cleaner_than": 44 }, "dns_server": { "ns": [ { "ip": "162.159.44.159", "host": "lewis.ns.cloudflare.com" }, { "ip": "162.159.38.247", "host": "thea.ns.cloudflare.com" } ], "zone": "forbet.info.pl" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "forbet.info.pl" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "MX": [ "{\"exchange\": \"route2.mx.cloudflare.net\", \"priority\": 56}", "{\"exchange\": \"route1.mx.cloudflare.net\", \"priority\": 72}", "{\"exchange\": \"route3.mx.cloudflare.net\", \"priority\": 43}" ], "NS": [ "thea.ns.cloudflare.com", "lewis.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"lewis.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416631044, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 include:_spf.mx.cloudflare.net ~all" ], "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000; includeSubDomains", "message": "HSTS header does not contain the preload directive." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000; includeSubDomains", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://forbet.info.pl" ] }, "linked_pages": { "external": [ "https://odpowiedzialnagra.totalizator.pl/", "https://www.podatki.gov.pl/pozostale-podatki/gry-hazardowe/zaklady-wzajemne-i-gry-hazardowe-przez-internet/" ], "external_count": 2, "internal_count": 15 }, "whois": { "created": "2026-05-13T12:29:08Z", "updated": "2026-06-08T15:52:32Z", "expires": "2027-05-13T12:29:08Z", "nameservers": [ "lewis.ns.cloudflare.com." ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } } } } ```